Sudoers Manager

A standalone Python script to help administrators manage their sudoers file.

Contents

• Contact - how to reach us
• System Requirements - what you need
• Install - instructions for setting up Sudoers Manager
• Uninstall - how to get rid of it (not that you would ever want to, right?)
• Purpose - why this script exists at all
• Usage - how to wield Sudoers Manager
  • Options
  • Rules
• File Formatting - rules for how to write the sudoers file
• Safeguards - nobody wants to ruin their sudoers file
• Update History - list of changes to this script over time.

Contact

If you have any comments, questions, or other input, either file an issue or send us an email. Thanks!

System Requirements

• Unix-like system that employs /etc/sudoers for privilege escalation (e.g. OS X, Linux, etc.)
• Python 2.7+ (which you can download here)

Install

Move the sudoers_manager.py script into a root-executable location. We use /usr/local/sbin/. Make sure it is executable.

Uninstall

Remove the sudoers_manager.py script.

Purpose

Sudoers Manager is designed to help systems administrators to more easily administer super-user permissions. If you don't already know much about systems administration or the sudoers file, this script is probably not for you.

In most Unix-like systems, there is a file located at /etc/sudoers which contains a list of rules for privilege escalation. This file allows users to run commands as other users. Most frequently, this file is used to grant super-user ("root") privileges to non-root users.

The administration of the sudoers file is intricate, and it's important that you don't make mistake or else you risk losing all administrative access on the given computer (unless your root account has a password that you know).

Usage

The script is fully-featured to assist with the replacement and management of the /etc/sudoers file.

$ sudoers_manager.py [-hvVrbc] [-f file] [-d rule[,-d rule,...]] rule[,rule,...]

Options

Rules

Rules must be valid sudoers rules. I will not go into detail on those here, so check out the man pages for sudoers for more information.

File Formatting

To be able to use Sudoers Manager, you need a compliant sudoers file.

A "compliant" sudoers file must have all of the appropriate sections marked and in-order (even if they contain no rules). The sections are:

1. User Aliases (User_Alias)
2. Runas Aliases (Runas_Alias)
3. Host Aliases (Host_Alias)
4. Command Aliases (Cmnd_Alias)
5. Default Specifications (Defaults)
6. User Rules Specifications (User_Rule)

where the portion in parentheses indicates how Sudoers Manager names each of these sections.

These sections are marked with start and end comments in the file, such as:

[...]
#@start User_Alias
User_Alias <rule>
User_Alias <rule>
#@end User_Alias
[...]

You can see that the section start point must be written as #@start <section shortname> (and the end point is formatted similarly). You must have start and end points for all of the sections for the Sudoers Manager script to be able to modify the file.

It's entirely possible that you don't want to bother with this on your own, which I understand. Use the --migrate option to pull the rules out of an existing sudoers file and build a new file from the script's template.

Safeguards

It's important to understand that the sudoers file should not be tampered with by people who don't know what it does. If you write bad rules to the file, you may not be able to recover it and you'll be locked out of any administrative access permanently. That said, this script was written to try to prevent simple accidents from happening.

Validity

A sudoers file must follow particular formatting rules (which can be learned by reading the man pages for sudoers). The same command that is used for non-automated modification of the sudoers file, visudo, can also check a particular file to ensure that it is a valid sudoers file. Any time changes are proposed via Sudoers Manager, visudo is called to check that there won't be any problems with the new file. If any issues are found, the script will terminate and report the error.

Race Conditions

I have tried to ensure that there are no race conditions in the code. All writing happens to a temporary file, and when the writing is done the temporary file is moved into the place of the existing sudoers file atomically. Once the file is moved into place, it isn't modified in that place again. It will always be copied elsewhere and modified in a temporary location instead.

Automation

The Sudoers Manager script, while usable from the command line by any user with proper administrative privileges, was designed to be able to be run in a fully automated capacity to help systems administrators to push out changes to their vast fleets of computers without having to rewrite the sudoers file directly. When used with the appropriate flags, Sudoers Manager will not prompt for any input and will only exit unsuccessfully if the rules given to it are bad and cannot pass a visudo check.

Update History

This is a reverse-chronological list of updates to this project. The version numbers for this project were not very good at the beginning.